Hi Luis,<div><br></div><div>I'm digging around in the Keystone code right now and helping answer your questions is helping me learn the code base. Keep 'em coming!</div><div><br></div><div>Anyway, from what I can tell, you're correct that there's no general way to get all of the tenants that a user belongs to in the current high level API. However, there is already support for exactly this feature in the lower level API. In [1] you'll see that the Driver object has the method get_tenants_for_user. This method is implemented in all of the backends in [2] so there's support for it everywhere, it just hasn't been exposed in the high level API. Looking closer at [1] we see the comment,</div>
<div><br></div><div><div># NOTE(termie): seven calls below should probably be exposed by the api</div><div># more clearly when the api redesign happens</div></div><div><br></div><div>which includes the method get_tenants_for_user. Looks like it's just a matter of adding this method to one of the Routers to make it available in the REST API.</div>
<div><br></div><div>My advice to you is to track down termie and find out what the story is with the API redesign he mentions. Of course, you could always propose a blueprint to [3] and make the method available yourself ;)</div>
<div><br></div><div>Hope this helps,</div><div>Everett</div><div><br></div><div>[1] <a href="https://github.com/openstack/keystone/blob/master/keystone/identity/core.py" target="_blank">https://github.com/openstack/keystone/blob/master/keystone/identity/core.py</a></div>
<div>[2] <a href="https://github.com/openstack/keystone/tree/master/keystone/identity/backends" target="_blank">https://github.com/openstack/keystone/tree/master/keystone/identity/backends</a></div><div>[3] <a href="https://blueprints.launchpad.net/keystone">https://blueprints.launchpad.net/keystone</a></div>
<div><br><div class="gmail_quote">On Thu, May 3, 2012 at 5:27 PM, Luis Gervaso <span dir="ltr"><<a href="mailto:luis@woorea.es" target="_blank">luis@woorea.es</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">From admin port I want to list the tenants a user (different from the current user) belongs to.<div><div>
<br><br><div class="gmail_quote">On Fri, May 4, 2012 at 1:24 AM, Gabriel Hurley <span dir="ltr"><<a href="mailto:Gabriel.Hurley@nebula.com" target="_blank">Gabriel.Hurley@nebula.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">On the keystone admin port the tenants call will list all tenants (provided the token corresponds to a user who has admin privileges).<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p style="margin-left:24.75pt">
<u></u><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><span>-<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Gabriel<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> openstack-bounces+gabriel.hurley=<a href="mailto:nebula.com@lists.launchpad.net" target="_blank">nebula.com@lists.launchpad.net</a> [mailto:<a href="mailto:openstack-bounces%2Bgabriel.hurley" target="_blank">openstack-bounces+gabriel.hurley</a>=<a href="mailto:nebula.com@lists.launchpad.net" target="_blank">nebula.com@lists.launchpad.net</a>]
<b>On Behalf Of </b>Luis Gervaso<br>
<b>Sent:</b> Thursday, May 03, 2012 1:24 PM<br>
<b>To:</b> Everett Toews<br>
<b>Cc:</b> <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
<b>Subject:</b> Re: [Openstack] Keystone API question<u></u><u></u></span></p>
</div>
</div><div><div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Yes, this is the real issue.<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Since /tenants is only valid for the current user (that's X-Auth-Token dependant)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">How can an administrator user list all the tenants a user belongs to?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Another issue i've detected is that endpoints are always dependant on a service,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">may be i'm wrong but for me:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">/service/{service_id}/endpoints<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">is more appropiate than<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">/endpoints<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Dolph, please correct me<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Luis<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, May 3, 2012 at 10:12 PM, Everett Toews <<a href="mailto:everett.toews@cybera.ca" target="_blank">everett.toews@cybera.ca</a>> wrote:<u></u><u></u></p>
<p class="MsoNormal">I get the same as Luis when trying GET /users/{user_id}/roles on stable/essex (using devstack). Keystone spits back an<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">AttributeError: 'UserController' object has no attribute 'get_user_roles'<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal">message instead of a nice 501.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">GET /tenants/{tenant_id}/users/{user_id}/roles works fine. For a bit more detail have a look at<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="http://docs.openstack.org/api/openstack-identity-service/2.0/content/GET_listRolesForUserOnTenant_v2.0_tenants__tenantId__users__user_id__roles_Admin_API_Service_Developer_Operations-d1e1356.html" target="_blank">http://docs.openstack.org/api/openstack-identity-service/2.0/content/GET_listRolesForUserOnTenant_v2.0_tenants__tenantId__users__user_id__roles_Admin_API_Service_Developer_Operations-d1e1356.html</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span><span style="color:#888888">Everett</span></span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, May 3, 2012 at 9:34 AM, Dolph Mathews <<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>> wrote:<u></u><u></u></p>
<div>
<p class="MsoNormal">The philosophy in essex is that it's meaningless for a user to have a role without that role being applied to a tenant, so the call that's implemented is:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> GET /tenants/{tenant_id}/users/{user_id}/roles<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Calling this instead should get you an HTTP 501 stating "User roles not supported: tenant ID required".<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> GET /users/{user_id}/roles<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Also, the term "roleRefs" was deprecated late in the diablo cycle (AFAIK) in favor of "roles".<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888">-Dolph<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">On Wed, May 2, 2012 at 3:44 PM, Luis Gervaso <<a href="mailto:luis@woorea.es" target="_blank">luis@woorea.es</a>> wrote:<u></u><u></u></p>
</div>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">Hi,<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In Diablo was:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Courier;color:#dd1144">GET /users/{user_id}/roleRefs</span><br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In Essex it is maintained for compatibility reasons. I understand that this is the obsolete now.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I can find:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Courier;color:#dd1144">PUT & DELETE /users/{user_id}/roles/OS-KSADM/{role_id}</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">How can get all the roles having a user_id?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">GET /users/{user_id}/roles (i can't find this on stable/essex)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Returning role list with tenant associated<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Another option that would work for me is:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">GET /users/{user_id}/tenants<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Returning tenant list with role list associated per tenant<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">When i GET /user/{user_id} i obtain only this info<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">{"user": {"name": "admin", "enabled": true, "email": "<a href="mailto:admin@example.com" target="_blank">admin@example.com</a>", "id": "ef1e63df85b641d7bf3c575bb8670cef", "tenantId": null}}<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><u></u> <u></u></span></p>
</div>
<p class="MsoNormal"><span style="color:#888888">-- <br>
-------------------------------------------<br>
Luis Alberto Gervaso Martin<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="color:#888888">Woorea Solutions, S.L<br>
CEO & CTO<br>
mobile: <a href="tel:%28%2B34%29%20627983344" target="_blank">(+34) 627983344</a><br>
<a href="mailto:luis.gervaso@gmail.com" target="_blank">luis@</a><a href="http://woorea.es/" target="_blank">woorea.es</a><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><u></u><u></u></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <br>
-------------------------------------------<br>
Luis Alberto Gervaso Martin<u></u><u></u></p>
<div>
<p class="MsoNormal">Woorea Solutions, S.L<br>
CEO & CTO<br>
mobile: <a href="tel:%28%2B34%29%20627983344" value="+34627983344" target="_blank">(+34) 627983344</a><br>
<a href="mailto:luis.gervaso@gmail.com" target="_blank">luis@</a><a href="http://woorea.es/" target="_blank">woorea.es</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div></div>
</div>
</div>
</blockquote></div><br><br clear="all"><br>-- <br>-------------------------------------------<br>Luis Alberto Gervaso Martin<div>Woorea Solutions, S.L<br>CEO & CTO<br>mobile: <a href="tel:%28%2B34%29%20627983344" value="+34627983344" target="_blank">(+34) 627983344</a><br>
<a href="mailto:luis.gervaso@gmail.com" target="_blank">luis@</a><a href="http://woorea.es/" target="_blank">woorea.es</a></div>
<br>
</div></div></blockquote></div><br></div>